BTCPay Server, the self-hosted Bitcoin payment processor relied on by merchants across Europe and beyond, has released version 2.4.7, an emergency update fixing a critical security vulnerability together with several medium-severity flaws. The project is urging all administrators to apply the patch as soon as possible.
The flaws were not found by the project's own developers but by an open-source frontier code scanner built by Anthropic, the artificial intelligence company. Anthropic reported the findings privately to the BTCPay Server team, allowing a fix to be prepared before the vulnerabilities could be exploited. BTCPay Server's team publicly thanked Anthropic for the responsible disclosure.
The project also acknowledged the strain this kind of discovery places on a small, largely volunteer-driven operation. BTCPay Server said it is currently defending the network against AI-assisted attacks, a remark that underlines how automated tools are now being deployed on both sides of the security equation: to find vulnerabilities before criminals do, and increasingly by criminals themselves.
For merchants and operators across Europe who run BTCPay Server to accept bitcoin payments without relying on a third-party processor, the update path depends on how the software was deployed. Administrators with admin permissions can apply version 2.4.7 directly from the maintenance panel in internal settings. Those running Docker-based servers need to connect via SSH to execute the manual update script. Operators using independent node platforms such as Umbrel or Start9 will have to wait until those providers push the official update through their own interfaces, meaning the fix will not reach every self-hosted installation at the same pace.
Part of a wider pattern
The patch lands amid what has been described as a "black October" for cybersecurity, a period marked by an unusual concentration of serious vulnerabilities across the digital environment. Among them is PHP2Shell, a critical flaw in the programming language underpinning most of the active web.
The Bitcoin network's own protocol is completely immune to PHP2Shell. But the extensive commercial infrastructure built around it, exchanges, payment tools and related web services, has been exposed to potential malicious actors in recent weeks. Charles Guillemet, chief technology officer at Ledger, described the scenario as "truly terrifying."
The BTCPay Server case illustrates both sides of that exposure: a widely used piece of Bitcoin-adjacent infrastructure carrying a critical flaw, and an AI-driven scanner catching it before it could be weaponised. For European merchants and node operators, the practical takeaway is immediate: check the deployment method and apply version 2.4.7 without delay.
